FAQ

FAQ

Is this a VPN service with public servers?

No. MASQUE VPN is self-hosted software. You provide the VPS, deploy the server, and issue client credentials.

Traffic exits at your VPS.

Which release should I download?

The current GitHub Latest release is v2.1.0.

It includes Android phone/TV APKs, a Windows MSI, Linux server binaries, installation scripts, checksums, Docker sources, and the experimental Windows VPS Setup Helper.

The iOS client is distributed separately through TestFlight.

Which clients are available?

• Android phone.
• Android TV.
• Windows.
• iOS 2.0 through TestFlight.

Phone and TV use separate APKs. No IPA is attached to GitHub Releases. TestFlight availability is not an App Store release.

Does it use UDP or TCP?

Both are supported by the current server:

• HTTP/3 CONNECT-IP over QUIC/UDP is the normal transport.
• HTTP/2 CONNECT-IP over TLS/TCP uses the same port number.

Allow both protocols separately in the host and cloud firewalls if you want both.

What does Automatic mean?

It is the client's automatic connectivity mode. Do not interpret it as a continuous speed test or a guarantee that the fastest transport will always be selected.

Use UDP only and TCP only for controlled troubleshooting.

Why does the server address show a website?

The v2.1.0 TCP listener serves an HTML page to browsers and connections without a valid client certificate.

That page is not VPN access. A valid client certificate and HTTP/2 CONNECT-IP request are still required for the tunnel.

UDP does not serve a website.

Why does the browser show a certificate warning?

The server certificate is signed by the private CA, not a CA normally trusted by browsers.

This is expected for the documented deployment. Do not enable insecure in the VPN client to suppress a browser warning.

Do I need new profiles after upgrading to 2.1.0?

No profile or certificate format change is required for v2.1.0.

Preserve the existing CA, certificates, and configuration when updating the server. Do not regenerate credentials merely because the binary changed.

Can old clients use the new server?

Older UDP clients, including v1.7.1, can connect to the v2.1.0 server over UDP.

Older iOS 1.7 is UDP-only. iOS 2.0 supports UDP and TCP with the current server.

Can a new client use an older server?

Yes, over UDP.

TCP requires a v2.0.0 or v2.1.0 server. The browser-facing HTML behavior is specific to v2.1.0, not the earlier v2.0.0 experiment.

Can I use one profile on all my devices?

Issue one profile per device.

Do not reuse one active identity across simultaneous devices. Profiles contain private keys and must be transferred privately.

Is a profile QR code safe to share?

No. If the QR encodes the profile, it contains credential material.

The v2.1.0 Windows installer displays a profile QR code, but that alone does not confirm scanner support on every phone client.

What MTU should I use?

Start with the v2.1.0 Android/TV/Windows default of 1340.

If transfers stall, test smaller values systematically and compare UDP and TCP. Do not change several settings at once.

Client MTU and server TUN MTU are separate. See MTU Testing.

Is TCP always faster than UDP?

No universal ranking is established.

Results depend on the network path, packet loss, filtering, MTU, congestion, and device/server behavior. Historical measurements describe their tested path, not every deployment.

What does Ping measure?

On QUIC connections, it is the smoothed QUIC RTT to the server.

A TCP-session ping must not be called QUIC RTT. Do not assume measurements from different transports or clients are identical.

Does the kill switch remain active after the app is killed?

Do not assume so.

The application-level mechanism depends on the platform and service lifecycle. Android Always-on VPN / Block connections without VPN is a separate OS feature.

Test process termination, reconnect, reboot, and manual disconnect on the actual device.

Does it support IPv6?

The project supports IPv6 QUIC transport and optional IPv6 inside the tunnel, but these are separate capabilities.

The VPS needs appropriate WAN connectivity, forwarding, routes, and firewall/NAT configuration. Account for older clients and platform differences.

Does it include DoH or DoT?

Not as a built-in tunnel DNS feature.

The documented tunnel DNS is plaintext DNS carried inside the encrypted client-to-VPS tunnel. It is visible at the VPS.

Does closing the Windows window disconnect the VPN?

No. The service owns the tunnel. Use Disconnect in the GUI or tray controls.

Normal GUI operation does not require elevation after installation.

Is the Windows VPS Setup Helper the VPN client?

No.

• The MSI installs the Windows VPN client.
• masque-setup.exe deploys and manages a Linux server over SSH.

The helper needs a matching Linux server binary beside it or selected in the UI.

Can I rerun install.sh to upgrade?

Do not treat it as an in-place updater.

It is designed for fresh installation and refuses to overwrite an existing CA, configuration, or service. Follow the server guide and preserve credentials during an upgrade.

Why does main still show another Android version?

The source branch and published release assets are separate.

At the documentation update, main declared Android versionName 2.0.0 and versionCode 25, while the published release was v2.1.0. Use the matching release tag and workflow when investigating release builds.

When does the iOS build expire?

Check the installed build in TestFlight.

The old iOS 1.7 / Apple build 20 had a 4 December 2026 expiry. Do not apply that date to iOS 2.0.

Is the project audited or guaranteed to bypass filtering?

No independent security audit or guaranteed bypass is claimed.

This is experimental software. Review Security Model and test it in your own environment.

Where should I report a problem?

Start with Troubleshooting.

For a bug, open an issue with versions, transport, MTU, reproduction steps, and sanitized logs.

For security vulnerabilities, follow the security policy. Never publish real profiles or private keys.